home

firefox-13108-dp.exe

Program

Setup Alpha (Alpha Criteria Ltd.)

The application firefox-13108-dp.exe, “Program Setup ” by Setup Alpha (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
App Web   (signed by Setup Alpha (Alpha Criteria Ltd.))

Product:
Program

Description:
Program Setup

Version:
3.6.3.6

MD5:
51549992da6098776a1016f617664183

SHA-1:
fed5bc62a86fe6af7684a89704986d3d37142b0b

SHA-256:
0e03cd51216165c540b0b428491c4cad13cf741de3af3bb5682801e8629f91c6

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 10:52:49 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.3.1

File size:
934.9 KB (957,360 bytes)

Product version:
4.2

Copyright:
Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\firefox-13108-dp.exe

Digital Signature
Signed by:
Setup Alpha (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 1:45:15 PM

Valid to:
8/26/2016 5:19:30 PM

Subject:
CN=Setup Alpha (Alpha Criteria Ltd.), O=Setup Alpha (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11219B5C9AAA1BB2894A8F5BBBA84E94A0E8

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:cTtftJCzKgXvzcszH4bUgkH+4rS92XbN9:cR2zICYvz4rS92rN9

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 5 URLs.

http://www.presentbytecontent.com/c?x=6q8lvUCitGZ7M8ABhABe0jkqxofG8d7pMa0XkEfV058=&c=lQA3erPEPTlhz nC005hoDr6AIPlmxGosPeL5Rbip 4dRToM5zPCMCJnYqsUt0H/rgDS PU/JMMj5qSexmIomZ2ZUjOdLs7OrT87r7W9ZF1gFak5t10yh dO35AjPU45zVueWceo3w48oN7pM7CgtA==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.3/win64/.../Firefox Setup 43.0.3.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentbytecontent.com/c?x=bUTYhspcP/DLWxs WmYxEE/Dh9oiVumaJypG/ px2Ro=&c=Fm99/rBk0gNYYUCLsxNqLlqW1L6GD1ue0MU4Ee4XmYsITLVHnIo5nC5wTbY6dsR9DW01x5tSp/JpXfgBPsM6aXTUzCJ7L3eoPhV2Mg0QGyG080EZABaeGZUUjveS7AFLesyu3T8aouOUCgwKnGhg2w==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.3/win64/.../Firefox Setup 43.0.3.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentbytecontent.com/c?x=rOkm0faZlbN6LOSNWfbMDtSOZvLkc8dBzNQqJK8xMNM=&c=JhrIJRhfitmAj4JDaZc y6NXtJnfzlJ8Q3PDYm6DqlRru2mLf/aNbwD515c41G/x2nayz7QtNyoSRtbQkV /kT7i1h9E27DjGokfOoyg1sOYmadk4bAGG2RIgzuMdXhkq 1fQiUN444nhRogLisnRA==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.3/win64/.../Firefox Setup 43.0.3.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentbytecontent.com/c?x=VzP2X6LIa0Bs50ALeueiBV6Y7HuBEY6MpLkTGmVSEmE=&c=LFJZeIR/2ITL8CNQtgitEDMSe jvgEXAppv4WYUmouxM9ma/9GMsE// N/pW wL65tdG/1SUL0hU6PCamcZ1qdOOWsdYB idzUMhKokPniws8B4k55//JUwGGptMxpt8H8LLOAePpo6vTwIpyBWxgg==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.3/win64/.../Firefox Setup 43.0.3.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentbytecontent.com/c?x=eLxZiSq8ehVQcWbLngJlTsNA6lXao9td0lhNuXlk0YA=&c=try0DGy6q5w3NGAWMPpIaTe7y/38dFawo6M jtBW4f0bvu2Z9HB65yerky55JRQaXZms HAWG3IidQN5D AWZwX7ByCsl7aD2uaG7BOdrD6i0xf1zENz3qoQJYhBnTC5NLyrOfyr8Ch C3xWjLLHyw==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.3/win64/.../Firefox Setup 43.0.3.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.